How to identify packet number where IP gets resolved

QBox Module 5
#1

This is what I get from wireshark. How do we check the packet numbers where IP is getting resolved.

Capture
Capture1471×772 275 KB

#2

read the references carefully.

#3

Just figured out that the protocol should be DNS, but as you can see in the screenshot there’s none.

#4

ok,carefully catch the packet using tcpdump.

#5

Hey you have to fillter DNS packet in the wireshark.
DNS translates domain names to IP addresses, so browsers can load Internet resources.
You can go through this below link, as to understand how to filter out DNS packets in wireshark :slight_smile:
https://osqa-ask.wireshark.org/questions/55754/whata-a-display-filter-that-matches-dns-queries-for-a-particular-host-name
Hope this solved your issue :slight_smile:

1 Like
#6

I captured only DNS packets from tcpdump but I can’t figure out in which one IP is getting resolved :thinking:

image
image1917×1024 98.5 KB

#7

Can you try changing value of -i flag to any for tcpdump command while capturing the packets? Please check if that helps capturing the packet you are looking for.

#8

it seems that you have not captured the packet for ip resolved
capture the packets with tcpdump using filters
i would suggest to filter the packets based on the ports

#9

Thanks all, seems like there was some issue with that pcap. I captured again in a new pcap and I got the required name resolution.

#11

Hey can anyone tell me how to get the packet number ?Is it the Leftmost column in the Wireshark ?
I wrote all the dns captures in a pcap file and opened it in wireshark.
Thanks

#12

Yes @srinjoy, it is.

#13

could you please specify which port should be captured.Because when I capture at 8081 nothing is captured.

#14

It says
Standard query response No such name SOA ns1.google.com
Am i doing something wrong?

#15

See this

#16

You have to find the ip where google.com is changed
Hint it start with 172

#17

meaning? ip is changed? i really dont understand what you are telling me

#18

Where name google.com is changed you will find it in last column of wireshark

1 Like
#19

Every site have ip address and dns … Just google about it… You will get an idea

#20

Found it. Thanks!! I am getting those type of responses only twice or thrice in my entire .pcap file. Is it fine or should i do something?

#21

It’s fine
Next time do google search please